XBEL Recently Opened Files Check

The recently-used.xbel XML file documents recent files on a Linux system that were accessed by applications. By parsing the file & checking how many files were recently accessed, we can determine whether or not a system is likely a sandbox or virtual machine. If a system has a low amount of files being accessed, it's likely a sandbox/VM.

Technique Identifier

U1352

Evasion Categories

Sandbox Evasion

Code Snippets

import xml.etree.ElementTree as ET
import os.path

XMLFile = os.path.expanduser("~/.local/share/recently-used.xbel")

# Threshold is how many recently accessed files to look for to differentiate between sandbox/VM & real user
# If the recently accessed count is lower than the threshold, it's assumed to be a sandbox/VM
threshold = 10 

# Parse XML file & extract filenames & the respective application name that was used to open/view file
def extractElements(XMLFile):
    tree = ET.parse(XMLFile)

    root = tree.getroot()

    appFile = []

    for item in root.findall("./bookmark"):
        filePath = item.get("href")


        applicationHandle = item.find(".//{*}application")
        applicationName = applicationHandle.get("name")


        appFile.append(f"{applicationName}:{filePath}")

    return appFile

if __name__ == "__main__":
    elements = extractElements(XMLFile)
    if len(elements) < threshold:
        print(f"[!] Recently accessed file count is lower than set threshold! Possible sandbox/VM (file count: threshold): {len(elements)}:{threshold}")
    else:
        print(f"[+] Recently accessed file count is higher than set threshold. Possibly an active user (file count: threshold): {len(elements)}:{threshold}")

About Author Open Snippet

Author: Issac Briones (1d8) / Target Platform: Linux

Contributor

Issac Briones (1d8)

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Virtualization/Sandbox Evasion: User Activity Based Checks, Sub-technique T1497.002 - Enterprise | MITRE ATT&CK®

Created

January 6, 2025

Last Revised

March 24, 2026